Google Street View broke Canada's privacy law with Wi-Fi capture

A Google Street View car in action - this one in the Prinsengracht in Amsterdam, Netherlands. Photograph: Toussaint Kluiters/EPA

Google violated the privacy of thousands of Canadians when it inadvertently collected personal information about them with its Street View mapping cars, the country's privacy commissioner has ruled.

In the wake of the finding, influential privacy groups expressed concern that no legal action had yet been taken against the search giant.

Google committed a "serious violation of Canadians' privacy rights" when it accidentally intercepted and stored data including emails and, separately, names of people suffering from certain medical conditions, Jennifer Stoddart, the Canadian privacy commissioner said on Tuesday.

The commissioner's investigation showed that confidential information of thousands of Canadian citizens was picked up by Google's Street View cars as they mapped the surrounding environment. Google apologised for the capture in May.

Stoddart said Google should tighten up its privacy policy before 1 February, or face further action.

Upon hearing the ruling, Privacy International, a UK-based pressure group, wrote on Tuesday to the commissioner [OPCC] expressing concern.

Alexander Hanff, an adviser to Privacy International, told the Guardian: "We are deeply concerned by the statement and have raised those concerns with the OPCC directly.

"They [the OPCC] have stated that this was the work of a lone engineer which is so implausible it beggars belief and could potentially have consequences which impact on ongoing cases elsewhere in the world."

The Australian privacy commissioner has already ruled that Google's data capture broke the country's privacy law. Communications minister Stephen Conroy labelled it the "single greatest breach in the history of privacy".

The news leaves the ruling by the UK's information commissioner that Google is unlikely to have collected "significant amounts of personal data" or data likely to "cause any individual detriment" looking increasingly conspicuous. Privacy campaigners Big Brother Watch considered the conclusion "farcical" at the time.

Privacy International on Tuesday told the Guardian it was unlikely that the UK commissioner would revisit the case, even in light of the findings of equivalent bodies in other countries.

Google said that it had "been working with the Office of the Privacy Commissioner in its investigation and will continue to answer the commissioners questions and concerns".

Experts from the Canadian privacy commissioner's office examined the offending data at Google's Mountain View headquarters. Here, it was established that the incident "was the result of a careless error" of one Google engineer who developed the unintentionally-nefarious code in 2006.

The engineer identified "superficial privacy implications" with the code, the commissioner found, but the implications were never assessed by other Google officials and the company was unaware of the presence of the code when its Street View cars were rolled into action.

The Canadian privacy commissioner ordered Google to delete all of the confidential data collected in the country and said it must comply with its security recommendations by 1 February.

[This update was added on 20 October 2010: A spokeswoman for the Privacy Commissioner of Canada said: "At this point, our Google WiFi investigation remains open and has not been formally concluded. We await Google's response and will determine whether further action is warranted at that time.

"Under Canadian privacy law, if, at the end of an investigation, we are not satisfied with the organisation's response, we can go to the federal court to seek an order for the organisation to correct its practices. The court also has the power to award damages."]

• This article was amended on 20 October 2010 to amend the subheading and include a comment from the Privacy Commissioner of Canada's office

Sign up for the Guardian Today

Our editors' picks for the day's top news and commentary delivered to your inbox each morning.